Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 116 posts

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#61

Post by opcvx »

Amezarak wrote: post #48
fdahgrthkn wrote: post #6

Earlier quoted context omitted.

"using this system from the start" I don't use Windows, so I cannot use this system at all. "add you neighbor on Facebook and get free access to their WiFi" That's missing the much bigger downside. Give your neighbor your Wi-Fi password and they can share it with hundreds of their friends automatically. Microsoft claims users will not be able to find the password and that users will only be able to access the Interne…

> Give your neighbor your Wi-Fi password and they can share it with hundreds of their friends automatically. Give your neighbor your Wi-Fi password, and they can trumpet it on the streets, distribute on pamplets, post it on HN, and update their Facebook status with it. I am a little shocked at the HN reaction here. I've had a Windows Phone since January and I've thought the feature was not only useful, but a great id…

The problem is that it is automatic, it spreads without confirming anything and without any deliberate action.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#62

Post by SomeStupidPoint »

mikeash wrote: post #42
themartorana wrote: post #40

Earlier quoted context omitted.

Yeah but, you're basically agreeing to assume risk. You still get a choice - you choose to ignore the TOS and click through. Time and again courts have upheld click-through TOS and EULAs. Ignorance is rarely an excuse. So if something clicks through a captive portal for you, the defense of "I didn't know..." isn't going to hold much water. The only defense might be that Microsoft accepted the terms and they should ac…

There's a pretty big difference between "it was too long and I didn't read it so I just clicked Agree at the bottom" and "I had no idea the thing was even there because Microsoft's software hid it from me." If there was no reasonable way for you to even know the terms were there at all, I don't think any court is going to consider them to be binding. That's why these places show them to you when you try to use their…

Accessing a computer network that is secured by requiring authentication by bypassing authentication via technical means might be a computer crime.

It's quite possible that using the Microsoft software to bypass a captive portal without agreeing to the terms will land you in jail for a felony.

Is Microsoft going to indemnify you against being the trial case of that legal theory?

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#63

Post by OJFord »

Nullabillity wrote: post #35
zzleeper wrote: post #26

Earlier quoted context omitted.

So you are saying I can't opt out of both? Or will they take XYZ_nomap_optout ?

The Microsoft page says it has to contain _optout, not that it has to end with it.

Presumably for this reason; so XYZ_optout_nomap works. But this is just silly.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#64

Post by OJFord »

Sodel wrote: post #54

Isn't this the definition of "unauthorized access", as far as the law is concerned? I'd be less uncomfortable if you had to deliberately choose which friends to share a certain network with. "Share with this person", or something.

You'd think - because presumably this could come about without you ever signing up to 'WiFi Sense' or any such EULA, if you give one Win10 friend the password, all his friends have it without you even realising WS exists?

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#65

Post by SomeStupidPoint »

After thinking about it for a bit, couldn't a worm with fake Facebook accounts that are friends-of-friends with a high percentage of the population use this to spread virtually unimpeded?

I suspect that the API is such that all of the friends of the fake accounts will relay to the fake accounts all of their respective friends passwords (given they had connected to said friend's network at least once), and that two steps should given sufficient coverage in dense urban areas to get worms that give near total wifi coverage of the area.

Such a worm platform could of course be used to launch a wide range of attacks, as it has a relatively high concentration and a solid coverage of the area (for data relaying).

This screams badness at every level: it's relying on the notion of a Facebook friendship to root security, despite that Facebook friendships have no such semantic meaning in the context of Facebook.

You were doing so well Microsoft... but this... this is really, really bad, to the point it might pose an infrastructure risk for cities.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#66

Post by platinumdragon »

underwater wrote: post #27
Animats wrote: post #21

This is a lot like what got Google in trouble - mapping all WiFi access points while collecting StreetView images. Microsoft is just doing it in a distributed way. Does all the collected WiFi data go to Microsoft HQ?

Google captured and stored traffic from unencrypted WiFi connections. It is not really similar at all.

They grabbed MACs and SSIDs and paired them with GPS coordinates, not traffic. It is entirely the same.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#67

Post by ytdht »

dd9990 wrote: post #24

"The only way to opt out of this "feature" is to change the name of your SSID to include _optout at the end" Google requires you to have "_nomap" at the end of SSIDs to "opt out" of certain services...

are you saying that SSIDs should have infinite lengths?

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#68

Post by manigandham »

How do features like these even get thought up, planned out, implemented then released without anyone in such a massive company wondering if there might be some issues? Or building it as opt-in or at the very least giving easy settings to disable it.

Automation like this is dangerous, I'm not sure saving 10 seconds is worth this kind of massive trust and security breach. When I give someone my wifi password, I know they can just post it on Facebook but at least that's a conscious decision. Same with accepting EULA, at least that was a choice, even if I didn't read it. Doing either thing automatically though is just ridiculous in terms of privacy, security and potential legality so how does a giant company with lots of smart developers and lawyers decide this is a good idea?

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#69

Post by burnte »

zyxley wrote: post #60
Aloha wrote: post #47

If you set up your network using radius, this becomes a non-issue radius is not horribly hard to set up either - its also not automatic, the user has to choose to share the wifi password - which they could do anyhow, as you've given it to them to connect. https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/w... - Section: "I'm concerned about sharing WiFi networks. Can you tell me a little more?"

Radius?

https://en.wikipedia.org/wiki/RADIUS

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#70

Post by jacalata »

dagw wrote: post #50
jacalata wrote: post #45

Note that this has been a public feature since windows phone 8 was released, two and a half years ago.

It came with WP 8.1, so it's only be around for about year. The real difference is that hardly anybody uses WP 8.1, whereas there is a very real chance that Windows 10 will become a popular and widespread OS.

oops, you're right on the release.
Post reply on HN